The sequence of search-time operations

When you run a search, the Splunk software runs several operations to derive various knowledge objects and apply them to the events returned by the search. These knowledge objects include extracted fields, calculated fields, lookup fields, field aliases, tags, and event types.

The Splunk software performs these operations in a specific sequence. This can cause problems if you configure something at the top of the process order with a definition that references the result of a configuration that is farther down in the process order.

Search-time operations order example

Consider calculated fields. Calculated field operations are in the middle of the search-time operation sequence. The Splunk software performs several other operations ahead of them, and it performs several more operations after them. Calculated fields derive new fields by running the values of fields that already exist in an event through an eval formula. This means that a calculated field formula cannot include fields in its formula that are added to your events by operations that follow it in the search-time operation sequence.

For example, when you design an eval expression for a calculated field, you can include extracted fields in the expression, because field extractions are processed at the start of the search-time operation sequence. By the time the Splunk software processes calculated fields, the field extractions exist and the calculated field operation can complete correctly.

However, an eval expression for a calculated field should never include fields that are added through a lookup operation. The Splunk software always performs calculated field operations ahead of lookup operations. This means that fields added through lookups at search time are unavailable when the Splunk software processes calculated fields. You will get an error message if your calculated field eval expression includes fields that are added through lookups.

Search-time operation sequence

The following table presents the search-time operation sequence as a list. After the list you can find more information about each operation in the sequence.

Each operation can have configurations that reference fields derived by operations that precede them in the sequence. However, those same configurations cannot contain fields that are derived by operations that follow them in the sequence.

All but one of these operations can be configured through Splunk Web, though some configuration options are only available by making manual .conf edits. You should make all manual file-based operation configurations on the search-head tier.

Note: This list does not include index-time operations, such as default and indexed field extraction. Index-time operations precede all search-time operations. See Index-time versus search time in Managing Indexers and Clusters of Indexers.

Search-time operation order

Operation name

Can be configured via Splunk Web?

Location of file configuration

First

Inline field extraction (no field transform)

Yes

EXTRACT-<class> in a props.conf stanza

Second

Field extraction that uses a field transform

Yes

REPORT-<class> in a props.conf stanza.

Third

Automatic key-value field extraction

No

props.conf stanzas, where KV_MODE is set to a valid value other than none. If no KV_MODE value is specified for a stanza, it is set to auto by default.

Fourth

Field aliasing

Yes

FIELDALIAS-<class> in a props.conf stanza

Fifth

Calculated fields

Yes

EVAL-<fieldname> in a props.conf stanza

Sixth

Lookups

Yes

LOOKUP-<class> in a props.conf stanza.

Seventh

Event types

Yes

eventtypes.conf stanza

Eighth

Tags

Yes

tags.conf stanza

Inline field extractions

Inline field extractions are explicit field extractions that do not include a field transform reference. An explicit field extraction is a field extraction that is configured to extract a specific field or set of fields.

Each inline field extraction configuration is specific to events belonging to a particular host, source, or source type.

This operation does not include automatic key-value field extractions. Automatic key-value field extractions are their own operation category.

Splunk Web management

Create and manage inline field extractions in Settings. Navigate to Settings > Fields > Field extractions. You can also use the field extractor utility to design inline field extractions.

Configuration information

Create EXTRACT-<class> configurations within props.conf stanzas.

Restrictions

The Splunk software processes all inline field extractions belonging to a specific host, source, or source type in lexicographical order according to their <class> value. This means that you cannot reference a field extracted by EXTRACT-aaa in the field extraction definition for EXTRACT-ZZZ, but you can reference a field extracted by EXTRACT-aaa in the field extraction definition for EXTRACT-ddd. See Lexicographical processing of field extraction configurations.

Because they are at the top of the search-time operation sequence, inline field extraction configurations cannot reference fields that are derived and added to events by any other search-time operation.

Field extraction that uses a field transform

Field extraction configurations that reference a field transform are always processed by the Splunk software after it processes inline field extractions. Like inline field extractions, each transform-referencing field extraction is explicitly configured to extract a specific field or set of fields.

Each transform-referencing field extraction configuration is specific to events belonging to a particular host, source, or source type.

This operation does not include automatic key-value field extractions. Automatic key-value field extractions are their own operation category.

Splunk Web management

You can create and manage field extractions that use field transforms in Settings. Navigate to Settings > Fields and set the field extraction up using the Field Extractions and Field Transformations pages.

Configuration information

Create REPORT-<class> configurations within props.conf stanzas. The REPORT-<class> configurations include a reference to an additional configuration in transforms.conf.

Restrictions

The Splunk software processes all inline field extractions belonging to a specific host, source, or source type in lexicographical order according to their <class> value. This means that you cannot reference a field extracted by EXTRACT-aaa in the field extraction definition for EXTRACT-ZZZ, but you can reference a field extracted by EXTRACT-aaa in the field extraction definition for EXTRACT-ddd. See Lexicographical processing of field extraction configurations.

Transform-referencing field extraction configurations can reference fields that are extracted through inline field extraction operations. They cannot reference fields that are derived and added to events by automatic key-value field extractions and other operations that take place later in the search-time operation sequence.

Automatic key-value field extraction

A field extraction configuration that uses the KV_MODE attribute to automatically extract fields for events associated with a specific host, source, or source type.

Automatic key-value field extraction is not explicit, in that you cannot configure it to find a specific field or set of fields. It looks for any key=value patterns in events that it can find and extracts them as field/value pairs. It can be configured to extract fields from structured data formats like JSON, CSV, and table-formatted events.

Automatic key-value extraction always takes place after explicit field extraction methods (inline field extraction and transform--referencing field extraction).

Splunk Web management

You can configure KV_MODE for source types through Splunk Web. When you are editing source types via Settings you can use the Advanced tab of the Edit Source Types dialog to change the value of KV_MODE from true to false or vice versa. See Manage source types in the Getting Data In manual.

Configuration information

Set up automatic key-value field extractions for a specific host, source, or source type by finding (or creating) the appropriate stanza in props.conf and setting the KV_MODE attribute to auto, auto_escaped, multi, json, or xml.

When KV_MODE is not set for a props.conf stanza, that stanza has KV_MODE=auto by default. You have to set KV_MODE=none to disable automatic key-value field extraction for a specific host, source, or source type. When automatic key-value field extraction is disabled, explicit field extraction still takes place.

When KV_MODE is set to auto or auto_escaped, automatic JSON field extraction can take place alongside other automatic key/value field extractions. If you need to disable JSON field extraction without changing the KV_MODE value from auto, add AUTO_KV_JSON=false to the stanza. When not set, AUTO_KV_JSON defaults to true.

Restrictions

The Splunk software processes automatic key-value field extractions in the order that it finds them in events.

You can create aliases for fields that are extracted at index time or search time. You cannot create aliases for fields that are added to events by search-time operations that follow the field aliasing process, like lookups and calculated fields.

Calculated fields

Configurations that create one or more fields through the calculation of eval expressions and add those fields to events. The eval expression can use values of fields that are already present in the event due to index-time or search-time field extraction processes.

Each calculated field configuration is specific to events belonging to a particular host, source, or source type.

All EVAL-<fieldname> configurations within a single props.conf stanza are processed in parallel, rather than in any particular sequence. This means you can't "chain" calculated field expressions, where the evaluation of one calculated field is used in the expression for another calculated field.

Calculated fields can reference all types of field extractions as well as field aliases. They cannot reference lookups, event types, or tags.

Lookups

Configurations that add fields from lookup tables to events when the lookup table fields are matched with one or more fields already present in those events. There are four distinct types of lookup configurations: CSV lookups, external lookups, KV Store lookups, and geospatial lookups.

Each lookup configuration is specific to events belonging to a particular host, source, or source type.

Define lookups that automatically add fields to events in search results by creating a LOOKUP-<class> configuration in props.conf. Each LOOKUP-<class> includes a reference to a [<lookup_name>] stanza in transforms.conf.

Event types

Configurations that add event type field/value pairs to events that match the search strings that define the event types.

Splunk Web management

After you run a search, save it as an event type. You can also define and maintain event types in Settings. Navigate to Settings > Event types.

Configuration information

Configure event types in eventtypes.conf stanzas.

Restrictions

The Splunk software processes event types first by priority score and then by lexicographical order. So it processes all event types with a Priority of 1 first, and applies them to events in lexicographical order. Then it processes event types with a Priority of 2, and so on.

You can apply tags to any field/value pair in an event, whether it is extracted at index time, extracted at search time, or added through some other method, such as an event type, lookup, or calculated field.

Lexicographical order

Lexicographical order sorts items based on the values used to encode the items in computer memory. In Splunk software, this is almost always UTF-8 encoding, which is a superset of ASCII.

Numbers are sorted before letters. Numbers are sorted based on the first digit. For example, the numbers 10, 9, 70, 100 are sorted lexicographically as 10, 100, 70, 9.

Uppercase letters are sorted before lowercase letters.

Symbols are not standard. Some symbols are sorted before numeric values. Other symbols are sorted before or after letters.

Example

For example, the Splunk software extracts inline field extractions to a specific host, source, or source type in ASCII sort order. This means that when it processes inline field extractions belonging to the access_combined_wcookies source type, it processes an extraction called REPORT-BBB before REPORT-ZZZ, then process REPORT-ZZZ before REPORT-aaa, and so on.

This means that you cannot reference a field extracted by REPORT-aaa in the field extraction definition for REPORT-BBB.

For example, this configuration won't work because the first_ten field is extracted after the first_two field, due to field extraction process ordering (aaa < ZZZ).

More information about process order within a single props.conf file

The Admin Manual contains several topics about configuration file administration. One of these topics, Attribute precedence within a single props.conf file, may be of particular interest to those interested in knowledge object processing order. It discusses the following topics.

Precedence between sets of stanzas affecting the same host, source, or source type.

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »